gentle-pi 2.0.0 → 2.1.0

package/tests/native-review-consent.test.ts

@@ -0,0 +1,128 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import test from "node:test";
+import { GENTLE_AI_VERSION } from "../lib/gentle-ai-binary.ts";
+import {
+	NativeReviewCliV216,
+	NativeReviewConsentRequiredError,
+	clearNativeReviewCapabilitiesCacheForTesting,
+	type ExecFileAdapter,
+} from "../lib/native-review-cli.ts";
+import type { ReviewConsentV2 } from "../lib/review-integration-v2.ts";
+
+const fixtureRoot = join(process.cwd(), "contracts", "review-integration", "v2", "fixtures");
+const fixture = <T = Record<string, unknown>>(name: string): T => JSON.parse(readFileSync(join(fixtureRoot, name), "utf8")) as T;
+const executableDigest = "dcc846103b16d365eaeeb9d7f289c23fc4f2897f23def1cb3fe7f05557b64705";
+
+function capabilities(): Record<string, unknown> {
+	const value = fixture<Record<string, unknown>>("capabilities.fixture.json");
+	(value.package as Record<string, unknown>).version = GENTLE_AI_VERSION;
+	return value;
+}
+
+function unrelatedStatus(targetIdentity: string): Record<string, unknown> {
+	const status = fixture<Record<string, unknown>>("status.fixture.json");
+	status.applicability = "unrelated";
+	status.receipt = { status: "not_applicable" };
+	status.action = "start";
+	status.replayability = "not_replayable";
+	status.target_identity = targetIdentity;
+	status.candidates = [];
+	delete status.authority;
+	delete status.frozen;
+	delete status.next_transition;
+	const projection = status.projection as Record<string, unknown>;
+	projection.initial_snapshot_identity = targetIdentity;
+	projection.current_snapshot_identity = targetIdentity;
+	return status;
+}
+
+function queuedAdapter(outputs: readonly Record<string, unknown>[]): { adapter: ExecFileAdapter; calls: Array<readonly string[]> } {
+	const queue = [...outputs];
+	const calls: Array<readonly string[]> = [];
+	return {
+		calls,
+		adapter: async (request) => {
+			calls.push(request.arguments);
+			const body = queue.shift();
+			if (body === undefined) throw new Error("unexpected native invocation");
+			return { stdout: JSON.stringify(body), stderr: "", exitCode: 0, signal: null, timedOut: false, outputLimitExceeded: false };
+		},
+	};
+}
+
+function client(adapter: ExecFileAdapter): NativeReviewCliV216 {
+	clearNativeReviewCapabilitiesCacheForTesting();
+	return new NativeReviewCliV216(adapter, "/package/.gentle-ai/gentle-ai", 30_000, 1024 * 1024, async () => undefined, () => executableDigest);
+}
+
+test("negotiated ordinary START declares relay and preserves the complete target-bound consent envelope", async () => {
+	const consent = fixture<Record<string, unknown>>("consent.fixture.json");
+	const target = String(consent.target_identity);
+	const queue = queuedAdapter([
+		capabilities(),
+		unrelatedStatus(target),
+		consent,
+	]);
+	await assert.rejects(
+		() => client(queue.adapter).start({ cwd: "/repo" }),
+		(error: unknown) => {
+			assert.ok(error instanceof NativeReviewConsentRequiredError);
+			assert.deepEqual(error.consent.raw, consent);
+			assert.equal(error.consent.targetIdentity, target);
+			return true;
+		},
+	);
+	assert.deepEqual(queue.calls.at(-1), [
+		"review", "start", "--contract", "gentle-ai.review-integration/v2", "--cwd", "/repo",
+		"--target", target, "--projection", "workspace", "--consent", "relay",
+	]);
+});
+
+test("consent follow-up executes the provider-named invocation exactly once and refuses a changed target binding", async () => {
+	const consent = fixture<ReviewConsentV2 extends never ? never : Record<string, unknown>>("consent.fixture.json");
+	const decodedConsent = (await import("../lib/review-integration-v2.ts")).decodeReviewConsentV2(consent);
+	const started = JSON.parse(JSON.stringify(fixture<Record<string, unknown>>("start.fixture.json"))
+		.replaceAll("review-start-fixture", "review-consent-fixture")) as Record<string, unknown>;
+	const queue = queuedAdapter([capabilities(), started]);
+	const native = client(queue.adapter);
+	const result = await native.answerConsent!({ cwd: "/repo", consent: decodedConsent, answer: "granted" });
+	assert.equal(result.kind, "started");
+	assert.deepEqual(queue.calls.at(-1), decodedConsent.choices[0].invocation.split(" ").slice(1));
+	assert.equal(queue.calls.filter((arguments_) => arguments_.includes("granted")).length, 1);
+
+	const changed = structuredClone(decodedConsent);
+	changed.targetIdentity = `sha256:${"b".repeat(64)}`;
+	await assert.rejects(
+		() => native.answerConsent!({ cwd: "/repo", consent: changed, answer: "declined" }),
+		/target|binding/,
+	);
+});
+
+test("declined consent decodes the provider's explicit empty authority fields without creating a lineage", async () => {
+	const rawConsent = fixture<Record<string, unknown>>("consent.fixture.json");
+	const consent = (await import("../lib/review-integration-v2.ts")).decodeReviewConsentV2(rawConsent);
+	const declined = {
+		operation: "review/start",
+		action: "declined",
+		lenses_required: false,
+		lineage_id: "",
+		state: "",
+		risk_level: "high",
+		selected_lenses: [],
+		lens_bindings: [],
+		projection: "workspace",
+		target_identity: consent.targetIdentity,
+		changed_files: 1,
+		changed_lines: 1,
+		correction_budget: 0,
+		risk_evidence: ["shell scripting in scripts/deploy.sh"],
+		consent: "declined_this_candidate",
+	};
+	const queue = queuedAdapter([capabilities(), declined]);
+	const result = await client(queue.adapter).answerConsent!({ cwd: "/repo", consent, answer: "declined" });
+	assert.equal(result.kind, "declined");
+	assert.equal("lineageId" in result, false);
+	assert.deepEqual(queue.calls.at(-1), consent.choices[1].invocation.split(" ").slice(1));
+});

package/tests/native-review-parity-runtime.test.ts

@@ -378,7 +378,7 @@ test("official pinned package runtime keeps frozen candidate lineages and receip
 	t.diagnostic("pre-push, pre-pr, and release require remote/publication evidence; their network-aware gate contracts remain covered by dedicated gate integration tests rather than this hermetic binary E2E.");
 });
 
-test("registered gentle_review START materializes a safe internal skill symlink before invoking native authority", async (t) => {
+test("registered gentle_review START materializes a safe internal skill symlink and cleans pending consent on session shutdown", async (t) => {
 	const workspace = await mkdtemp(join(tmpdir(), "gentle-pi-v215-symlink-candidate-"));
 	const repository = join(workspace, "repository");
 	t.after(async () => rm(workspace, { recursive: true, force: true }));
@@ -412,8 +412,9 @@ test("registered gentle_review START materializes a safe internal skill symlink
 		return { ...command, signal: null, timedOut: false, outputLimitExceeded: false };
 	});
 	const tools = new Map<string, RegisteredController>();
+	let sessionShutdown: ((event: unknown, context: ExtensionContext) => Promise<void> | void) | undefined;
 	createGentleAiExtension({ nativeReviewCli: native, candidateViews } as Parameters<typeof createGentleAiExtension>[0])({
-		on() {},
+		on(name: string, handler: (event: unknown, context: ExtensionContext) => Promise<void> | void) { if (name === "session_shutdown") sessionShutdown = handler; },
 		registerTool(definition: RegisteredController & { name: string }) { tools.set(definition.name, definition); },
 		registerCommand() {},
 	} as unknown as ExtensionAPI);
@@ -434,8 +435,16 @@ test("registered gentle_review START materializes a safe internal skill symlink
 	t.diagnostic(JSON.stringify({ returned: returned?.details, error, nativeStartReached }));
 	assert.equal(thrown, undefined, "safe internal symlink materialization must not throw before START");
 	assert.equal(nativeStartReached, true, "safe internal symlink materialization must reach native START");
-	const result = (returned?.details as { result?: Record<string, unknown> } | undefined)?.result;
-	assert.equal(typeof result?.lineage_id, "string", "safe internal symlink materialization must return native review authority");
-	assert.equal(result?.state, "reviewing");
-	candidateViews.cleanup(candidateViews.resolveForLens(result!.lineage_id as string, "review-reliability").token);
+	const result = returned?.details as Record<string, unknown> | undefined;
+	assert.equal(result?.status, "blocked");
+	assert.equal(result?.outcome, "native-review-consent-required");
+	assert.equal(typeof result?.consent_binding, "string");
+	assert.equal(result?.lineage_created, false);
+	assert.ok(sessionShutdown, "extension must register session_shutdown cleanup");
+	const context = { cwd: repository, hasUI: false, ui: { notify: () => {} } } as unknown as ExtensionContext;
+	await sessionShutdown({}, context);
+	await assert.rejects(
+		controller.execute("answer-after-shutdown", { operation: "answer-consent", input: JSON.stringify({ consentBinding: result!.consent_binding, answer: "granted" }) }, undefined, undefined, context),
+		/unknown, expired, or already consumed/,
+	);
 });

package/tests/native-review-parity.test.ts

@@ -9,14 +9,16 @@ import { __testing, createGentleAiExtension } from "../extensions/gentle-ai.ts";
 import {
 	NATIVE_REVIEW_ERROR_CODE,
 	NativeReviewCliError,
+	NativeReviewConsentRequiredError,
 	NativeReviewCliV213 as NativeReviewCliV213Production,
 	setNativeCliContractForTesting,
 	type ExecFileAdapter,
 	type NativeReviewCli,
+	type NativeReviewConsentAnswer,
 } from "../lib/native-review-cli.ts";
 import { CandidateViewRegistry } from "../lib/review-candidate-view.ts";
-import { readReviewConsentLatch, recordReviewConsentLatch } from "../lib/review-consent-latch.ts";
-import type { AuthorityRepairAssessmentV1, ReviewStatusV3 } from "../lib/review-integration-v2.ts";
+import { recordReviewConsentLatch } from "../lib/review-consent-latch.ts";
+import type { AuthorityRepairAssessmentV1, ReviewConsentV2, ReviewStatusV3 } from "../lib/review-integration-v2.ts";
 
 // Queued-adapter clients never execute a real process; default to a fixed
 // absolute package-local path so these tests do not depend on an installed
@@ -407,18 +409,23 @@ interface RegisteredCommandFixture {
 	handler: (args: string, ctx: ExtensionContext) => Promise<void>;
 }
 
-function runtime(nativeReviewCli: NativeReviewCli | null): { controller: RegisteredTool; commands: Map<string, RegisteredCommandFixture> } {
+interface RegisteredEventFixture {
+	(event: unknown, ctx: ExtensionContext): Promise<unknown> | unknown;
+}
+
+function runtime(nativeReviewCli: NativeReviewCli | null): { controller: RegisteredTool; commands: Map<string, RegisteredCommandFixture>; events: Map<string, RegisteredEventFixture> } {
 	const tools = new Map<string, RegisteredTool>();
 	const commands = new Map<string, RegisteredCommandFixture>();
+	const events = new Map<string, RegisteredEventFixture>();
 	const dependencies = { nativeReviewCli, candidateViews: new CandidateViewRegistry() } as unknown as Parameters<typeof createGentleAiExtension>[0];
 	createGentleAiExtension(dependencies)({
-		on() {},
+		on(name: string, handler: RegisteredEventFixture) { events.set(name, handler); },
 		registerTool(definition: RegisteredTool & { name: string }) { tools.set(definition.name, definition); },
 		registerCommand(name: string, definition: RegisteredCommandFixture) { commands.set(name, definition); },
 	} as unknown as ExtensionAPI);
 	const controller = tools.get("gentle_review");
 	assert.ok(controller);
-	return { controller: controller!, commands };
+	return { controller: controller!, commands, events };
 }
 
 function headlessContext(cwd: string, notices: Array<{ message: string; type?: string }> = []): ExtensionContext {
@@ -447,6 +454,7 @@ test("kill-switch: effective off returns a non-failure skipped envelope and neve
 	const result = await execStart(controller, "kill-switch-off", headlessContext(cwd));
 	assert.equal(result.status, "skipped");
 	assert.equal(result.outcome, "review-mode-disabled");
+	assert.equal(result.delivery, "disabled/unmanaged");
 	assert.equal(result.mutation_performed, false);
 	assert.equal(state.startCalls, 0, "native start must not be called once the kill switch reports off");
 });
@@ -516,67 +524,168 @@ test("kill-switch: an unexpected reviewMode failure maps to the existing native-
 	assert.equal(result.outcome, "native-operation-failed");
 });
 
-test("consent: an existing latch skips the prompt and proceeds with actor_binding", async (t) => {
+function candidateConsent(cwd: string): ReviewConsentV2 {
+	const targetIdentity = `sha256:${"a".repeat(64)}`;
+	const choices = [
+		{ answer: "granted" as const, label: "Run the review now", effect: "Review this exact candidate only.", invocation: `gentle-ai review start --contract gentle-ai.review-integration/v2 --cwd ${cwd} --target ${targetIdentity} --projection workspace --lineage native-lineage --consent granted` },
+		{ answer: "declined" as const, label: "Not now, just this once", effect: "Create no authority and ask again next candidate.", invocation: `gentle-ai review start --contract gentle-ai.review-integration/v2 --cwd ${cwd} --target ${targetIdentity} --projection workspace --lineage native-lineage --consent declined` },
+	] as const;
+	const raw = { schema: "gentle-ai.review-integration.consent/v2", contract: "gentle-ai.review-integration/v2", operation: "review.start", action: "consent_required", blocking: true, target_identity: targetIdentity, projection: "workspace", risk_level: "high", changed_files: 1, changed_lines: 1, headline: "Review this candidate", reason: "It changes a process boundary.", value: "Review catches regressions.", risk_evidence: ["shell process"], choices: choices.map((choice) => ({ ...choice })), off_path: { note: "Disable reviews separately.", command: "gentle-ai review mode disable" } };
+	return { schema: "gentle-ai.review-integration.consent/v2", contract: "gentle-ai.review-integration/v2", operation: "review.start", action: "consent_required", blocking: true, targetIdentity, projection: "workspace", riskLevel: "high", changedFiles: 1, changedLines: 1, headline: "Review this candidate", reason: "It changes a process boundary.", value: "Review catches regressions.", riskEvidence: ["shell process"], choices, offPath: { note: "Disable reviews separately.", command: "gentle-ai review mode disable" }, raw };
+}
+
+function relayedConsentNative(cwd: string): { native: NativeReviewCli; answers: NativeReviewConsentAnswer[] } {
+	const { native } = fakeOrganicNative();
+	const consent = candidateConsent(cwd);
+	const answers: NativeReviewConsentAnswer[] = [];
+	native.start = async () => { throw new NativeReviewConsentRequiredError(consent); };
+	native.answerConsent = async (request) => {
+		answers.push(request.answer);
+		if (request.answer === "declined") return { kind: "declined", targetIdentity: consent.targetIdentity, projection: "workspace", riskLevel: "high", changedFiles: 1, changedLines: 1, consent: "declined_this_candidate", raw: { operation: "review/start", action: "declined", consent: "declined_this_candidate" } };
+		return { kind: "started", start: { lineageId: "native-lineage", state: "reviewing", riskLevel: "high", selectedLenses: ["review-risk", "review-resilience", "review-readability", "review-reliability"], changedFiles: 1, changedLines: 1, correctionBudget: 1, action: "created", lensesRequired: true } };
+	};
+	return { native, answers };
+}
+
+async function answerConsent(controller: RegisteredTool, binding: unknown, answer: unknown, ctx: ExtensionContext): Promise<Record<string, unknown>> {
+	const { details } = await controller.execute("consent-answer", { operation: "answer-consent", input: JSON.stringify({ consentBinding: binding, answer }) }, undefined, undefined, ctx);
+	return details as Record<string, unknown>;
+}
+
+async function blockedConsent(controller: RegisteredTool, id: string, ctx: ExtensionContext): Promise<Record<string, unknown>> {
+	const result = await execStart(controller, id, ctx);
+	assert.equal(result.status, "blocked");
+	assert.equal(result.outcome, "native-review-consent-required");
+	assert.equal(typeof result.consent_binding, "string");
+	return result;
+}
+
+test("consent relay returns the identical complete parent-visible envelope with or without UI and never answers internally", async (t) => {
 	const cwd = repository(t);
 	recordReviewConsentLatch(cwd);
-	const { native } = fakeOrganicNative({ riskEvidence: ["shell scripting in deploy.sh"] });
-	const { controller } = runtime(native);
-	const result = await execStart(controller, "consent-latched", confirmContext(cwd, false));
-	assert.ok(result.actor_binding, "an existing latch must not block actor_binding even though confirm() would decline");
-	assert.equal(result.consent_notice, undefined);
+	for (const ctx of [
+		{ cwd, hasUI: true, ui: { select: async () => { throw new Error("internal consent UI must not run"); }, notify: () => {} } } as unknown as ExtensionContext,
+		headlessContext(cwd),
+	]) {
+		const { native, answers } = relayedConsentNative(cwd);
+		const result = await blockedConsent(runtime(native).controller, "consent-blocked", ctx);
+		assert.deepEqual(result.consent, candidateConsent(cwd).raw);
+		assert.deepEqual(answers, []);
+		assert.equal(result.lineage_created, false);
+	}
 });
 
-test("consent: headless never blocks, always surfaces a notice, and leaves the latch untouched", async (t) => {
+test("explicit consent follow-up grants or declines exactly once", async (t) => {
 	const cwd = repository(t);
-	const { native } = fakeOrganicNative({ riskEvidence: ["service credentials in .env.example"] });
-	const { controller } = runtime(native);
-	const notices: Array<{ message: string; type?: string }> = [];
-	const result = await execStart(controller, "consent-headless", headlessContext(cwd, notices));
-	assert.ok(result.actor_binding, "headless must still run the review");
-	assert.equal(typeof result.consent_notice, "string");
-	assert.ok(notices.some((notice) => notice.type === "info" && notice.message === result.consent_notice));
-	assert.equal(readReviewConsentLatch(cwd), false, "headless must never consume/persist the one-time question");
+	for (const answer of ["granted", "declined"] as const) {
+		const { native, answers } = relayedConsentNative(cwd);
+		const { controller } = runtime(native);
+		const blocked = await blockedConsent(controller, `consent-${answer}`, headlessContext(cwd));
+		const result = await answerConsent(controller, blocked.consent_binding, answer, headlessContext(cwd));
+		assert.deepEqual(answers, [answer]);
+		if (answer === "granted") assert.ok(result.actor_binding);
+		else {
+			assert.equal(result.outcome, "consent-declined-this-candidate");
+			assert.equal(result.lineage_created, false);
+			assert.equal(result.actor_binding, undefined);
+		}
+		await assert.rejects(() => answerConsent(controller, blocked.consent_binding, answer, headlessContext(cwd)), /unknown, expired, or already consumed/);
+	}
 });
 
-test("consent: accepting the prompt records the latch and proceeds with actor_binding", async (t) => {
+test("consent follow-up rejects invalid token, unknown id, changed cwd, and changed target binding", async (t) => {
+	const cwd = repository(t);
+	const consent = candidateConsent(cwd);
+	const { native, answers } = relayedConsentNative(cwd);
+	native.start = async () => { throw new NativeReviewConsentRequiredError(consent); };
+	const { controller } = runtime(native);
+	const blocked = await blockedConsent(controller, "consent-invalid", headlessContext(cwd));
+	await assert.rejects(() => controller.execute("malformed", { operation: "answer-consent", input: "not-json" }, undefined, undefined, headlessContext(cwd)), /input is not valid JSON/);
+	await assert.rejects(() => controller.execute("extra", { operation: "answer-consent", input: JSON.stringify({ consentBinding: blocked.consent_binding, answer: "granted", target: "substitute" }) }, undefined, undefined, headlessContext(cwd)), /exactly consentBinding and answer/);
+	await assert.rejects(() => answerConsent(controller, blocked.consent_binding, "yes", headlessContext(cwd)), /answer must be granted or declined/);
+	await assert.rejects(() => answerConsent(controller, "missing", "granted", headlessContext(cwd)), /unknown, expired, or already consumed/);
+	const other = repository(t);
+	await assert.rejects(() => answerConsent(controller, blocked.consent_binding, "granted", headlessContext(other)), /repository binding changed/);
+	const originalTarget = consent.targetIdentity;
+	(consent as { targetIdentity: string }).targetIdentity = `sha256:${"b".repeat(64)}`;
+	await assert.rejects(() => answerConsent(controller, blocked.consent_binding, "granted", headlessContext(cwd)), /consent envelope binding changed/);
+	(consent as { targetIdentity: string }).targetIdentity = originalTarget;
+	(consent as { projection: string }).projection = "staged";
+	await assert.rejects(() => answerConsent(controller, blocked.consent_binding, "granted", headlessContext(cwd)), /consent envelope binding changed/);
+	(consent as { projection: string }).projection = "workspace";
+	(consent.choices[0] as { invocation: string }).invocation = consent.choices[0].invocation.replace("native-lineage", "changed-lineage");
+	await assert.rejects(() => answerConsent(controller, blocked.consent_binding, "granted", headlessContext(cwd)), /consent envelope binding changed/);
+	assert.deepEqual(answers, []);
+});
+
+test("ambiguous consent mutation consumes the one-shot binding and requires status instead of blind replay", async (t) => {
 	const cwd = repository(t);
-	const { native } = fakeOrganicNative({ riskEvidence: ["payments in billing.ts"] });
+	const { native } = relayedConsentNative(cwd);
+	let statusCalls = 0;
+	const targetStatus = native.targetStatus!;
+	native.targetStatus = async (request) => { statusCalls += 1; return await targetStatus(request); };
+	native.answerConsent = async () => { throw Object.assign(new Error("ambiguous"), { mutationOutcome: "unknown", nextAction: "review.status" }); };
 	const { controller } = runtime(native);
-	assert.equal(readReviewConsentLatch(cwd), false);
-	const result = await execStart(controller, "consent-accept", confirmContext(cwd, true));
-	assert.ok(result.actor_binding);
-	assert.equal(readReviewConsentLatch(cwd), true);
+	const blocked = await blockedConsent(controller, "consent-ambiguous", headlessContext(cwd));
+	await answerConsent(controller, blocked.consent_binding, "granted", headlessContext(cwd));
+	assert.equal(statusCalls, 2, "ambiguous consent must reconcile through target status");
+	await assert.rejects(() => answerConsent(controller, blocked.consent_binding, "granted", headlessContext(cwd)), /unknown, expired, or already consumed/);
 });
 
-test("consent: declining persists nothing, applies only to this work unit, and withholds actor_binding", async (t) => {
+test("session shutdown clears pending candidate consent bindings and is idempotent", async (t) => {
 	const cwd = repository(t);
-	const { native } = fakeOrganicNative({ riskEvidence: ["authentication in auth.ts"] });
-	const { controller } = runtime(native);
-	const result = await execStart(controller, "consent-decline", confirmContext(cwd, false));
-	assert.equal(result.actor_binding, undefined, "declining must withhold actor dispatch for this work unit");
-	assert.equal(readReviewConsentLatch(cwd), false, "declining must never persist anything");
-	assert.ok(result.result, "the native start result itself is still reported");
+	const { native, answers } = relayedConsentNative(cwd);
+	const { controller, events } = runtime(native);
+	const blocked = await blockedConsent(controller, "consent-before-shutdown", headlessContext(cwd));
+	const shutdown = events.get("session_shutdown");
+	assert.ok(shutdown);
+	await shutdown({}, headlessContext(cwd));
+	await shutdown({}, headlessContext(cwd));
+	await assert.rejects(() => answerConsent(controller, blocked.consent_binding, "granted", headlessContext(cwd)), /unknown, expired, or already consumed/);
+	assert.deepEqual(answers, []);
+});
+
+test("successful explicit disable clears pending candidate consent binding even after re-enable", async (t) => {
+	const cwd = repository(t);
+	const { native, answers } = relayedConsentNative(cwd);
+	let effective: "on" | "off" = "on";
+	native.reviewMode = async (request) => {
+		if (request.operation === "disable") effective = "off";
+		if (request.operation === "enable") effective = "on";
+		return { operation: request.operation, scope: "clone", status: { global: "", cloneLocal: effective === "off" ? "off" : "", effective, source: effective === "off" ? "clone_local" : "default" } };
+	};
+	const { controller, commands } = runtime(native);
+	const blocked = await blockedConsent(controller, "consent-before-disable", headlessContext(cwd));
+	const command = commands.get("gentle:review-mode")!;
+	await command.handler("disable", headlessContext(cwd));
+	await command.handler("enable", headlessContext(cwd));
+	await assert.rejects(() => answerConsent(controller, blocked.consent_binding, "granted", headlessContext(cwd)), /unknown, expired, or already consumed/);
+	assert.deepEqual(answers, []);
 });
 
-test("consent: an unreadable answer (confirm throws) still runs the review, leaves the latch untouched, and surfaces a notice", async (t) => {
+test("candidate-scoped decline creates no authority and the next candidate asks again", async (t) => {
 	const cwd = repository(t);
-	const { native } = fakeOrganicNative({ riskEvidence: ["an executable permission change in run.sh"] });
+	const { native, answers } = relayedConsentNative(cwd);
 	const { controller } = runtime(native);
-	const result = await execStart(controller, "consent-throw", throwingConfirmContext(cwd));
-	assert.ok(result.actor_binding, "an unreadable answer must still run the review");
-	assert.equal(typeof result.consent_notice, "string");
-	assert.equal(readReviewConsentLatch(cwd), false);
+	for (const id of ["decline-one", "decline-two"]) {
+		const blocked = await blockedConsent(controller, id, headlessContext(cwd));
+		const result = await answerConsent(controller, blocked.consent_binding, "declined", headlessContext(cwd));
+		assert.equal(result.outcome, "consent-declined-this-candidate");
+		assert.equal(result.lineage_created, false);
+		assert.equal(result.actor_binding, undefined);
+	}
+	assert.deepEqual(answers, ["declined", "declined"]);
 });
 
-test("consent stays dark (capability-gated) when the native start result carries no riskEvidence", async (t) => {
+test("low-risk zero-lens START remains silent", async (t) => {
 	const cwd = repository(t);
-	const { native } = fakeOrganicNative({ riskEvidence: undefined, lensesRequired: true });
+	const { native } = fakeOrganicNative({ riskEvidence: undefined, lensesRequired: false });
 	const { controller } = runtime(native);
-	let confirmed = false;
-	const ctx = { cwd, hasUI: true, ui: { confirm: async () => { confirmed = true; return true; }, notify: () => {} } } as unknown as ExtensionContext;
-	const result = await execStart(controller, "consent-dark", ctx);
-	assert.equal(confirmed, false, "no riskEvidence (dark riskEvidence capability) must never trigger the consent prompt");
-	assert.ok(result.actor_binding);
+	let selected = false;
+	const ctx = { cwd, hasUI: true, ui: { select: async () => { selected = true; return undefined; }, notify: () => {} } } as unknown as ExtensionContext;
+	const result = await execStart(controller, "consent-low-risk", ctx);
+	assert.equal(selected, false);
+	assert.ok(result.result);
 });
 
 // ---------------------------------------------------------------------------

package/tests/package-manifest.test.ts

@@ -212,7 +212,8 @@ test("installed commit transaction runner loads JavaScript only and has determin
 	assert.equal(packageJson.scripts?.["test:packed-runner"], "node scripts/test-packed-runner.mjs");
 	assert.match(packageJson.scripts?.prepublishOnly ?? "", /pnpm run test:packed-runner/);
 	assert.match(ci, /pnpm run test:packed-runner/);
-	assert.doesNotMatch(packedRunner, /\["install"[^\]]*"--ignore-scripts"/s);
+	assert.match(packedRunner, /\["install"[^\]]*"--ignore-scripts=false"/s, "packed install must explicitly enable postinstall");
+	assert.doesNotMatch(packedRunner, /\["install"[^\]]*"--ignore-scripts"(?!\=false)/s);
 	assert.match(packedRunner, /execFileSync\("where\.exe", \["npm"\]/);
 	assert.match(packedRunner, /could not resolve npm-cli\.js without a command shell/);
 	assert.doesNotMatch(packedRunner, /ComSpec|cmd\.exe/);
@@ -275,7 +276,13 @@ test("package verification binds the published Gentle AI v2.2.2 runtime pin", ()
 	const verifier = readFileSync(join(PACKAGE_ROOT, "scripts", "verify-package-files.mjs"), "utf8");
 
 	assert.match(installer, /INSTALLER_VERSION = "2\.2\.2"/);
+	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_PACKAGE.*GENTLE_AI_WINDOWS_SOURCE_MODULE/);
+	assert.match(installer, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM = "h1:YZcI5dRvoHm82I2CULvgBkB2M3UQQGarYO\/u\/Nt5LSc="/);
+	assert.match(installer, /GOTOOLCHAIN: "local"/);
+	assert.match(installer, /GOSUMDB: "sum\.golang\.org"/);
 	assert.match(binary, /GENTLE_AI_VERSION = "2\.2\.2"/);
+	assert.match(binary, /GO_SUMDB_SOURCE_BUILD/);
+	assert.match(binary, /GENTLE_AI_WINDOWS_SOURCE_MODULE_CHECKSUM/);
 	assert.match(verifier, /v2\.2\.2/);
 });
 
@@ -1130,9 +1137,9 @@ test("pi-pretty wrapper uses real package path resolution for pnpm symlink insta
 	assert.match(wrapper, /quietToolsEnabled/);
 });
 
-test("v2.0.0 release package and runtime stop before publication", () => {
+test("v2.1.0 release package and runtime stop before publication", () => {
 	const packageJson = readPackageJson();
-	assert.equal(packageJson.version, "2.0.0", "the release manifest must remain explicitly pinned to v2.0.0");
+	assert.equal(packageJson.version, "2.1.0", "the release manifest must remain explicitly pinned to v2.1.0");
 	assert.equal(
 		packageJson.scripts?.test,
 		"node --experimental-strip-types --test tests/*.test.ts && pnpm run test:harness",

package/tests/review-candidate-view.test.ts

@@ -584,6 +584,49 @@ test("native projections reconstruct symlink, intended-untracked, and gitlink id
 	assert.deepEqual(projection.gitlinks, { "vendor/dependency": gitlinkCommit });
 });
 
+test("native staged projections restore the exact current index over HEAD", (t) => {
+	const contributorRoot = repository(t);
+	const baseTree = git(contributorRoot, "rev-parse", "HEAD^{tree}");
+	writeFileSync(join(contributorRoot, "tracked.txt"), "staged candidate\n");
+	git(contributorRoot, "add", "tracked.txt");
+	const candidateTree = git(contributorRoot, "write-tree");
+	const registry = new CandidateViewRegistry();
+
+	registry.restoreProjectionFromNative("staged-index-projection", contributorRoot, {
+		baseTree,
+		currentCandidateTree: candidateTree,
+		paths: ["tracked.txt"],
+		intendedUntracked: [],
+		projection: "staged",
+	});
+
+	const projection = registry.resolveProjection("staged-index-projection", contributorRoot);
+	assert.equal(projection.baseTree, baseTree);
+	assert.equal(projection.candidateTree, candidateTree);
+	assert.equal(projection.committedOnly, false);
+});
+
+test("native staged projections reject a workspace snapshot that differs from the current index", (t) => {
+	const contributorRoot = repository(t);
+	const baseTree = git(contributorRoot, "rev-parse", "HEAD^{tree}");
+	writeFileSync(join(contributorRoot, "tracked.txt"), "workspace candidate\n");
+	const workspace = new CandidateViewRegistry().create({ contributorRoot });
+	try {
+		assert.throws(
+			() => new CandidateViewRegistry().restoreProjectionFromNative("workspace-as-staged", contributorRoot, {
+				baseTree,
+				currentCandidateTree: workspace.candidateTree,
+				paths: ["tracked.txt"],
+				intendedUntracked: [],
+				projection: "staged",
+			}),
+			(error: unknown) => error instanceof CandidateViewError && error.reason === "projection-kind-drift",
+		);
+	} finally {
+		workspace.cleanup();
+	}
+});
+
 test("native projections recover a committed range base from its frozen tree", (t) => {
 	const contributorRoot = repository(t);
 	const baseCommit = git(contributorRoot, "rev-parse", "HEAD");